Creating Microsoft Advertising credentials requires signing in to a Microsoft account that has been signed up to Microsoft Advertising and giving consent for Funnel to manage it.
The ability of a user to grant consent to Funnel depends on the type of account used to log in to Microsoft Advertising, either:
a Microsoft account (or personal account) created by an individual, or
a Microsoft Entra account (or work account) provisioned by an organisation via Microsoft Entra ID (Entra).
All accounts must fulfil the following conditions in order to grant consent to Funnel:
two-step authentication enabled
added as a user to either:
the Microsoft Advertising account intended as a data source
a Microsoft Advertising account with an account link to the one intended as a data source
Microsoft accounts (personal accounts) should able to grant consent to Funnel if the above conditions are met. Work accounts require an additional condition be met in order to grant consent to Funnel:
The Require sign-in with a work account setting must be enabled on the Microsoft Advertising account intended as a data source.
Work accounts fulfilling all the above conditions may still not be able to grant consent to Funnel due to restrictions imposed by the Entra configuration of the provisioning organisation. In this instance the individual or team responsible for provisioning work accounts at your organisation should be the first point of contact for guidance. Refer to the additional information for Entra administrators.
Depending on the Entra configuration that applies to a work account:
A dialogue for requesting admin approval is displayed
Submit the approval request and contact the individual or team responsible for provisioning work accounts at your organisation. Once the request is approved, you will be able to create credentials in FunnelA Funnel authentication error is displayed
A work account with sufficient Entra permissions and fulfilling the conditions required by Microsoft Advertising for work accounts outlined above must successfully create a Microsoft Advertising credential in Funnel. Two examples of achieving this are:
the individual or team responsible for provisioning work accounts (e.g. an IT admin) grants sufficient Entra permissions involving consent to work accounts that are used with Funnel (e.g. a digital marketer), or
an existing work account with sufficient Entra permissions (e.g. an IT admin) signs up to Microsoft Advertising, fulfils the conditions required by Microsoft Advertising for work accounts outlined above, and successfully creates a Microsoft Advertising credential in Funnel. Once the credential is successfully created, it may be removed from Funnel if not needed.
Once consent is granted via the successful creation of the first Microsoft Advertising credential in Funnel, all other work accounts in the same organisation will be able to consent to Funnel and create credentials.
Sign-in errors when connecting Microsoft Advertising
Sign-in fails, then "grant expired" or cached-login errors on retry
Why it happens: Your email address can exist as both a personal Microsoft account and a work (Microsoft Entra) account. If you sign in with the account type that isn't your Microsoft Advertising user, the connection fails. Retrying can then show cached login or AADSTS70000 "grant expired" errors.
What to do:
Open a new private (incognito) browser window.
Start the connection in Funnel again.
When Microsoft asks which account to use, pick the other account type (work instead of personal, or the other way round): the one that is your Microsoft Advertising user.
Error: "AADSTS700003: Device object was not found in the tenant directory"
What you see: Microsoft Advertising data sources show No access with this error, and reconnecting fails, even though you can still sign in to Microsoft Advertising.
Why it happens: The sign-in Funnel uses is tied to a device that has been removed from your organization's Microsoft Entra ID (Azure AD). Microsoft then rejects the connection. Your organization's Conditional Access (device compliance) policies can also cause this.
What to do:
Ask your IT administrator to re-register the device, or to review your Conditional Access device-compliance policies.
Reconnect the data source from a registered device. Or reconnect in a private (incognito) window after signing out of all Microsoft sessions.